Sophos Anti-Virus for Mac Home Edition

[spike]

Please note that this first post has been superseded by later news. Please follow the thread below.

Yesterday, 4-Nov, we posted about the issue that some of you have found, where scanning using the Home Edition tool has a significant impact on system performance. We now believe we can characterise and duplicate the problem, and have a work around. Here goes ...

Systems that have Bootcamp installed, with Windows installed on an NTFS partition will see this issue when a scan is run against the Bootcamp volume (this includes the Scan Local Drives).

The issue appears to be connected to Apple's NTFS kext, and we are in contact with Apple to discuss the issue further.

We are also going to investigate whether this issue occurs when using other 3rd party NTFS kexts, or if it is only in combination with Apple's. 

While we are discussing this issue with Apple, users can work around this issue by not using Scan Local Drives, and instead creating a custom scan that contains all drives and partitions except for the Bootcamp one.

If you've been affected by this issue, please accept our apologies. We're very grateful to those of you who have engaged with us here on SophosFreeTalk, and helped us understand the nature of the problem. Please watch this space, and post your comments on this work around here.

Best regards,

spike.

[grahamperrin]

---

spike wrote:

… whether this issue occurs when using other 3rd party NTFS kexts … 

---

… NTFS-3G Community Edition and Tuxera NTFS for Mac? (Any others?)

Do all processes relating to Sophos Anti-Virus have workarounds for a userspace where processes owned by root are denied access? 

[TheGrey]

Same behavior with "Paragon NTFS for Mac OS X".

Selecting "Turn the Paragon NTFS for Mac OS X driver off" in the Paragon System Prefs, brings my system load down to "normal".

I do not have Bootcamp. I do have VMware Fusion VMs on my local disk.

Hope this helps others and the Sophos Team to "fix" the problem.

Regards.

[spike]

Please note that this post has been updated below.

On 4-Nov, we posted about the issue that some of you experienced, where scanning using Sophos Anti-Virus for Mac Home Edition tool impacted on system performance. On 5-Nov, we posted again, with a partial explanation. This post is an update to that one. Here goes ...

Snow Leopard (Mac OS X 10.6) systems that have Bootcamp installed with Windows installed on an NTFS partition might see the a system slow-down or freeze when a scan runs against the Bootcamp volume (this includes when run via the Scan Local Drives option in the drop-down menu under the black shield icon in Mac title bar).

The issue appears to be connected to Apple's NTFS kext (a kernel extension used for device drivers), and we have contacted Apple to discuss the issue further and figure out a permanent resolution. This issue may also occur when using other third-party NTFS kexts. We continue our investigation and will update this forum with any information we find.  

While we work to resolve this issue with Apple, users can work around this issue by avoiding the Scan Local Drives option. Sophos Anti-Virus includes automatic on-access scanning. When Sophos Anti-Virus for Mac Home Edition is installed, the on-access protection feature is enabled automatically. On-access scanning is running when the Sophos shield in your title bar is black. There is no need to run a manual scan. For users that wish to do a manual scan, Sophos recommends that create a custom scan that contains all drives and partitions except for the Bootcamp one until the issue is resolved.

If you've been affected by this issue, please accept our apologies. We're very grateful to those of you who have engaged with us here on SophosFreeTalk, and helped us to better understand the nature of the problem. Please watch this space, and post your comments on this work around here.

Best regards,

spike.

[spike]

Please note that this post has been updated below.

We have been in discussion with Apple, and they have confirmed that this is a known issue with the Apple NTFS Kext. They are handling it as Bug ID 8646291.

We are continuing to investigate alternative solutions to this issue, and I’ll post updates to this thread whenever there is more news.

Regards,

spike

[grahamperrin]

spike wrote:

We have been in discussion with Apple, and they have confirmed that this is a known issue with the Apple NTFS Kext. They are handling it as Bug ID 8646291. …

---

Thanks to Spike and Apple.

@ Spike and @Sophos

Should we aim to keep separate the following three classes:

1. issues with SAV reported by users of Apple's support for NTFS
2. issues with SAV reported by users of Paragon NTFS† for Mac OS X 
3. issues with SAV reported by users of Tuxera NTFS for Mac, and NTFS-3G Community Edition, both with various versions of MacFUSE

— what's your gut feeling? 

Would it be good to draw the attention of Paragon and Tuxera  to this topic and/or the bug ID provided by Apple? Or is that premature? (I don't know whether any of those third party products depend on Apple's driver … suspect not.)

----

† http://www.paragon-software.com/home/ntfs-mac/release.html presumably not requiring MacFUSE; and from Paragon's release notes I can't tell whether their "support for … Snow Leopard … 64-bit mode" extends to 64-bit kernel and extensions. 

[spike]

See grahamperrin's post, below.  

[grahamperrin]

cross reference

SAV and TimeMachine

[infinity8ball]

I have an imac with 10.6 and a bootcamp partition.  It was crashing my mac every time I ran it and this work around fixed it!

[sandy]

Thanks for letting us know